CVE-2026-120470: Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1
Published Nov 12, 2026
·Updated
Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience.
Event History
Nov 12, 2026
CVE Published
via MITRE·05:58 PM
Data Sourced
via MITRE·05:58 PM
DescriptionWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated attacker can exploit it. No account or prior access is required to read affected online campaign versions.
2
Which campaign content may be exposed?
Campaigns that were never made public may be readable, including campaigns unpublished after sending and campaigns sent only to a restricted audience.
3
Which AcyMailing versions are affected?
The affected versions are AcyMailing 1.0.0 through 11.1.1.